# PoC: compute_numel() Integer Overflow on MSVC (Windows) Builds

**Vulnerability:** `c10/core/TensorImpl.h:2596-2604` — `compute_numel()` uses the unsafe `multiply_integers()` path on MSVC builds because `C10_HAS_BUILTIN_OVERFLOW()` is unconditionally 0 on MSVC (`safe_numerics.h:9-10`). This disables overflow detection for all Windows PyTorch users.

## Files

- `poc_numel_msvc_overflow.py` — Full PoC (crafted model + UBSan-confirmed overflow)
- `test_msvc_overflow.cpp` — Standalone C++ UBSan test
- `numel_overflow_model.pt` — Crafted model with overflow dimensions

## Quick Start

```bash
pip install torch
python poc_numel_msvc_overflow.py
```

## Expected Output

- GCC/Clang: `safe_compute_numel()` catches overflow (RuntimeError)
- MSVC path: `multiply_integers()` silently overflows (UBSan confirmed)